- Category
- State · Attributed to a state or working for one.
- Origin
- China(high confidence)
- Motivation
- Information theft and espionage
- Seen
- 2016
- Sources
- 7 sources carry it
- Identifier
- GINC-APT-0218 · lightbasin
What it is
UNC1945 is an APT group that has been targeting telecommunications companies globally. They use Linux-based implants to maintain long-term access in compromised networks. UNC1945 has demonstrated advanced technical abilities, utilizing various tools and techniques to evade detection and move laterally through networks. They have also been observed targeting other industries, such as financial and professional consulting, and have been linked to other threat actors, including MustangPanada and RedDelta.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- Luminal Panda
- Mandiant
- UNC1945
- Other names
- CL-CRI-0025, DecisiveArchitect, TH-239
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
Targets
- Sectors
- Financial, IT, Telecommunications
Tools
The tools and malware families the sources tie to it.
- CordScan
- Evilsun
- FRP
- Impacket
- Lemonstick
- Living off the Land
- Logbleach
- Oksolo
- Openshackle
- PingPong
- ProxyChains
- Pupyrat
- QEMU
- SIGTRANslator
- SMBExec
- Slapstick
- Steelcorgi
- Tinyshell
Sources
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de